Unknown Quiz And Survey Master Qsm vulnerabilities

7 CVEs affecting Unknown Quiz And Survey Master Qsm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-79615, published 2026-08-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14820, published 2026-07-27. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns…
CVE-2026-79615, published 2026-08-28. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as…
CVE-2026-14826, published 2026-08-19. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page…
CVE-2026-14825, published 2026-08-19. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level…
CVE-2026-14821, published 2026-07-28. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete…
CVE-2026-14824, published 2026-08-04. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with…
CVE-2025-6790, published 2025-08-14. Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a…